permdock 0.5.0 → 0.7.0

package/dist/{policy-from-catalog-DzhEc3Y9.js → policy-from-catalog-DFWYkNdu.js}

@@ -1,17 +1,17 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { p as normalizeWhere } from "./role-builder-CXbis5-X.js";
+import { p as normalizeWhere } from "./role-builder-C1VJzvcr.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { _ as resource, i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as defineScopes } from "./scopes-CUPSjo9q.js";
-import { f as definePlans, p as defineRoles } from "./grantee-Cn1HyUsI.js";
+import { i as getRegistry, n as findPermission, v as resource } from "./permission-registry-DpPtSKNZ.js";
+import { n as defineScopes } from "./scopes-BHsc-wp-.js";
+import { f as definePlans, p as defineRoles } from "./grantee-BrRANrpT.js";
 import { r as readWireValidity } from "./validity-CZ7-y0Cj.js";
-import { i as indexPolicy, u as normalizeDelegation } from "./policy-DLZJ5gAp.js";
-import { r as isPortableCondition } from "./hosted-BZIAYvon.js";
-import { t as definePermissions } from "./permissions-B-wCP5ZC.js";
+import { d as normalizeDelegation, i as indexPolicy } from "./policy-DaJy4nK4.js";
+import { o as isPortableCondition } from "./hosted-XBgU6RGT.js";
+import { t as definePermissions } from "./permissions-CyH2MV_B.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { n as parsePushedPolicy } from "./pushed-policy-DobP7AHI.js";
+import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
+import { n as parsePushedPolicy } from "./pushed-policy-CmYeSQqq.js";
 //#region src/catalog/json-schema-validator.ts
 const ANNOTATIONS = /* @__PURE__ */ new Set([
 	"$schema",

package/dist/{policy-types-DzwivBgR.d.ts → policy-types-B-F-qAZk.d.ts}

@@ -1,4 +1,5 @@
-import { E as PermissionTree, H as AppDataSchema, N as ResourceNode, T as PermissionKind, U as MetaValue, V as AppData, a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { A as MetaValue, O as AppData, b as ResourceNode, d as PermissionKind, f as PermissionTree, k as AppDataSchema, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan } from "./vocabulary-Bg3eeT2H.js";
 //#region src/conditions/ast.d.ts
 type ConditionRef = {
   readonly ref: string;
@@ -286,6 +287,7 @@ type TenantCustomRole = CustomRoleBody & {
   readonly id?: string;
   /** Input only: `scope` = the second scope, `id` = this team. */
   readonly team?: string;
+  readonly shared?: undefined;
 };
 /**
  * A role the platform defines, held through `principal.roles` like a declared
@@ -297,8 +299,23 @@ type GlobalCustomRole = CustomRoleBody & {
   readonly tenant?: undefined;
   readonly id?: undefined;
   readonly team?: undefined;
+  readonly shared?: undefined;
 };
-type CustomRole = TenantCustomRole | GlobalCustomRole;
+/**
+ * A role the platform defines once for every tenant, held on memberships of
+ * its scope in any tenant. Tenant admins assign it but never edit it. Its
+ * ceiling is the assignable declared roles of its scope; its name wins over
+ * a tenant custom role of the same name.
+ */
+type SharedCustomRole = CustomRoleBody & {
+  readonly shared: true;
+  /** The scope the role is held at, never `'global'`; defaults to the first scope. */
+  readonly scope?: string;
+  readonly tenant?: undefined;
+  readonly id?: undefined;
+  readonly team?: undefined;
+};
+type CustomRole = TenantCustomRole | SharedCustomRole | GlobalCustomRole;
 type Principal = {
   readonly id: string;
   readonly issuer?: string;
@@ -317,6 +334,8 @@ type Principal = {
   /** The authorization version the token was minted at (`authz_ver`). */
   readonly authzVersion?: number;
   readonly tenant?: string;
+  /** Set by core when a requested tenant is not one the subject holds: the denial is then `no-membership`, not `no-tenant`. Never read from a token. */
+  readonly unheldTenant?: string;
   readonly assurance?: Assurance;
   readonly binding?: Binding;
   readonly [key: string]: unknown;
@@ -361,7 +380,7 @@ type Subject<TPrincipal extends Principal = Principal> = {
 };
 //#endregion
 //#region src/core/decision.d.ts
-type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "agent-tool-not-delegated" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
+type DenialReason = "no-grant" | "condition" | "deny" | "inactive-grant" | "closure-error" | "opaque-condition" | "server-only" | "anonymous" | "not-delegated" | "no-delegation" | "agent-tool-not-delegated" | "insufficient-user-authentication" | "not-entitled" | "purpose" | "reason-required" | "actor-required" | "limit" | "limit-unavailable" | "relation-depth" | "relation-unavailable" | "validation" | "tenant-mismatch" | "no-membership" | "no-tenant" | "scope" | "expired-membership" | "stale-credentials" | "unknown-role" | "last-holder" | "max-holders" | "transfer-only" | "not-assignable-by" | "self-demotion" | "externally-managed" | "not-allowed-for-membership" | "conflicting-role" | "approval" | "stale-approval" | "pdp-denied" | "pdp-unavailable" | "pdp-invalid-response" | "undocumented" | "unsupported" | "exceeds-creator" | "credential-policy";
 /** The `detail` each denial reason carries, where PermDock sets a structured one. */
 type DenialDetails = {
   readonly limit: LimitDetail;
@@ -444,12 +463,14 @@ type LimitDetail = {
  * denial instead), `break-glass-inactive` (a break-glass grant with no
  * asserted purpose).
  */
-type TraceSkipReason = "via-only" | "purpose" | "field" | "grantee" | "role" | "validity" | "break-glass-inactive";
+type TraceSkipReason = "via-only" | "purpose" | "field" | "grantee" | "role" | "validity" | "unknown-level" | "break-glass-inactive";
 type TraceSkip = {
   readonly role: string | null;
   readonly permission: string;
   readonly effect: "allow" | "deny";
   readonly why: TraceSkipReason;
+  /** The level a custom role names that its resource does not declare, for `unknown-level`. */
+  readonly level?: string;
 };
 /**
  * What `explain` saw: how many candidate grants it examined before the
@@ -1079,6 +1100,62 @@ type LocalSnapshotManifest = {
   readonly grants: readonly SnapshotGrant[];
   /** Per custom-role scope (`global` for platform roles): the grants each entry resolves to. */
   readonly custom: Readonly<Record<string, LocalCustomRoleTable>>;
+  /** The synced tables a device reads the user's memberships, roles and custom roles from; `permdock powersync generate` adds it. */
+  readonly rows?: LocalSnapshotRows;
+};
+/** A column of a synced table, or a value every row has. */
+type LocalRowValue = {
+  readonly column: string;
+} | {
+  readonly value: string;
+};
+/**
+ * A column that holds a role key or user id: the value itself, the `column`
+ * of the synced `through` table whose `id` it references, or a value each
+ * maps to a role key (`null` for no role).
+ */
+type LocalRowColumn = {
+  readonly column: string;
+} | {
+  readonly column: string;
+  readonly through: {
+    readonly table: string;
+    readonly id: string;
+    readonly column: string;
+  };
+} | {
+  readonly column: string;
+  readonly map: Readonly<Record<string, string | null>>;
+};
+/** One synced membership table. Table names are the device's table names. */
+type LocalMembershipRows = {
+  readonly table: string;
+  readonly user: LocalRowColumn;
+  readonly scope: LocalRowValue;
+  readonly id: string;
+  /** The role columns (the row holds every non-null key), or the fixed roles every row holds. */
+  readonly roles: readonly LocalRowColumn[] | {
+    readonly value: readonly string[];
+  };
+  readonly via?: LocalRowValue;
+  /** A row with a value in one of these columns is no membership on the device. */
+  readonly expiresAt?: string;
+  readonly disabledAt?: string;
+};
+type LocalSnapshotRows = {
+  readonly memberships: readonly LocalMembershipRows[];
+  /** The global roles table: one row per user and role. */
+  readonly roles?: {
+    readonly table: string;
+    readonly user: string;
+    /** The role columns; the row holds every non-null key. */
+    readonly roles: readonly LocalRowColumn[];
+  };
+  /** The custom-role tables (`tenant_id`, `scope`, `scope_id`, `role`, and `permission`, `effect`, `level` or `include_role`). */
+  readonly customRoles?: {
+    readonly permissions: string;
+    readonly includes: string;
+  };
 };
 /** Grants a custom role entry resolves to, held by a placeholder role the client renames. */
 type LocalCustomRoleTable = {
@@ -1409,6 +1486,15 @@ type CustomRoleSource = {
   globalRoles?(context?: {
     readonly held: readonly string[];
   }): CustomRole[] | Promise<CustomRole[]>;
+  /**
+   * Shared custom roles (`shared: true`), defined once for every tenant and
+   * read once per subject with a tenant membership, with `held`, the role
+   * names its live memberships hold in any tenant. A role here without
+   * `shared: true` is ignored.
+   */
+  sharedRoles?(context?: {
+    readonly held: readonly string[];
+  }): CustomRole[] | Promise<CustomRole[]>;
 };
 /**
  * A `CustomRoleSource` built for the subject the instance serves, for an adapter
@@ -1450,11 +1536,29 @@ type MembershipSource = {
     readonly roles?: readonly string[];
     readonly memberships?: readonly Membership[];
   }): number | undefined | Promise<number | undefined>;
+  /**
+   * The global roles the principal holds now. With `onStale: 'reread'`, a
+   * stale token's `principal.roles` is replaced by this answer, so a revoked
+   * platform role is lost with the memberships. A throw or rejection leaves
+   * no global roles. Without it, a reread keeps the token's roles.
+   */
+  globalRolesFor?(principal: {
+    readonly id: string;
+    readonly kind?: string;
+  }): readonly string[] | Promise<readonly string[]>;
   /**
    * Keep the memberships the verified token carries and read this source only
    * when the token says they were truncated (`claimsFirst`).
    */
   readonly claimsFirst?: boolean;
+  /**
+   * What a token behind `version` gets. Only permissions the policy marks
+   * `fresh` look at staleness: `'deny'` (the default) denies those with
+   * `stale-credentials` and leaves every other permission on the token's
+   * claims; `'reread'` replaces the token's memberships (and global roles,
+   * when the source has `globalRolesFor`) with a live read for the whole
+   * subject, so no decision keeps a revoked grant.
+   */
   readonly onStale?: "deny" | "reread";
 };
 /** An object's parent chain, as `RelationSource.ancestors` returns it. */
@@ -2147,4 +2251,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { MemberEntry as $, Delegation as $n, DeliveryFailureCause as $t, PolicyScopes as A, relation as An, CredentialRequest as At, ValidateMode as B, LimitDetail as Bn, LocalSnapshotManifest as Bt, MembershipFixture as C, RelationGrantee as Cn, isConditionRef as Cr, Credential as Ct, PolicyDelegation as D, authenticated as Dn, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, assurance as En, CredentialPermission as Et, RoleScope as F, DenialDetails as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, TraceSkip as Gn, SnapshotScope as Gt, WireValidity as H, Obligation as Hn, SnapshotAssignable as Ht, SeparationConflict as I, DenialReason as In, parseCredential as It, EntitlementSource as J, Assurance as Jn, AutomationEvent as Jt, DecisionProvider as K, TraceSkipReason as Kn, AccessEvent as Kt, SubjectOf as L, DeniedDecision as Ln, InstanceHandle as Lt, PrincipalOf as M, ApprovalRequiredDecision as Mn, credentialDelegation as Mt, RoleBinding as N, Decision as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, inherit as On, CredentialPolicy as Ot, RoleOptions as P, Denial as Pn, decideCredential as Pt, LimitStore as Q, CustomRoleGrant as Qn, DeliveryEvent as Qt, SupportAccessOptions as R, ExplainedDecision as Rn, Instant as Rt, HostedGrantRef as S, InheritGrantee as Sn, isConditionDate as Sr, ApiKeyPrincipal as St, Policy as T, anyone as Tn, CredentialKind as Tt, CredentialVerifier as U, Quota as Un, SnapshotGrant as Ut, VocabularyFromInput as V, MatchedGrant as Vn, Snapshot as Vt, CustomRoleSource as W, Trace as Wn, SnapshotNotEntitled as Wt, LimitConsumeInput as X, Binding as Xn, DecisionEvent as Xt, JwtClaims as Y, AuthorizationDetail as Yn, CredentialEvent as Yt, LimitRemaining as Z, CustomRole as Zn, DeliveryChannel as Zt, GrantLimit as _, anyOf as _n, RestrictedAncestors as _r, SupportSessionDecision as _t, ApprovalRequirement as a, WireDenial as an, VerifiedClaims as ar, SettingsSource as at, GrantScope as b, Grantee as bn, hasConditionOp as br, decideSupportSession as bt, BreakGlassOptions as c, Scope as cn, MembershipVia as cr, TenantSettings as ct, ClosureContext as d, AnyOfApprover as dn, ConditionValue as dr, TokenVerifier as dt, DirectoryEvent as en, GnapAccess as er, MembershipSource as et, ClosureGrantFn as f, Approver as fn, MemberOfCondition as fr, VerificationFailure as ft, GrantCondition as g, allOf as gn, RelatedHop as gr, SupportSession as gt, Grant as h, UserApprover as hn, RelatedCondition as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, WireDecision as in, Subject as ir, RelationSource as it, PolicyVocabulary as j, AppObligation as jn, DecideCredentialOptions as jt, PolicyOptions as k, plan as kn, CredentialPolicyViolation as kt, BreakGlassRequirements as l, ScopeDeclaration as ln, Condition as lr, TokenFailureCause as lt, DelegationTarget as m, PermissionApprover as mn, OpaqueCondition as mr, WhereCompiler as mt, ApprovalEscalation as n, MembershipEvent as nn, Membership as nr, RelationGroup as nt, ApprovalStage as o, WireDelegation as on, ActorKind as or, SnapshotSource as ot, DelegationInput as p, ApproverInput as pn, MemberOfParent as pr, VerifiedToken as pt, DecisionSink as q, Actor as qn, AuthEvent as qt, ApprovalMode as r, SinkEvent as rn, Principal as rr, RelationHolder as rt, AssuranceRequirement as s, PolicyScopesInput as sn, AdapterId as sr, SubjectResolver as st, ActivationOption as t, EmailCategory as tn, JsonWebKeyLike as tr, RelationChain as tt, BreakGlassSpec as u, ScopeNames as un, ConditionRef as ur, TokenSigner as ut, GrantMeta as v, holder as vn, SqlFunctionArg as vr, SupportSessionPolicy as vt, ObligationInput as w, actor as wn, isSqlFunctionField as wr, CredentialDecision as wt, GrantValidity as x, GranteeInput as xn, isCondition as xr, parseSupportSession as xt, GrantOptions as y, user as yn, SqlFunctionCondition as yr, SupportSessionRequest as yt, SupportConsent as z, GrantedDecision as zn, LocalCustomRoleTable as zt };
+export { MemberEntry as $, AuthorizationDetail as $n, CredentialEvent as $t, PolicyScopes as A, assurance as An, CredentialRequest as At, ValidateMode as B, DenialReason as Bn, LocalMembershipRows as Bt, MembershipFixture as C, user as Cn, SqlFunctionArg as Cr, Credential as Ct, PolicyDelegation as D, RelationGrantee as Dn, isConditionDate as Dr, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, InheritGrantee as En, isCondition as Er, CredentialPermission as Et, RoleScope as F, AppObligation as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, MatchedGrant as Gn, Snapshot as Gt, WireValidity as H, ExplainedDecision as Hn, LocalRowValue as Ht, SeparationConflict as I, ApprovalRequiredDecision as In, parseCredential as It, EntitlementSource as J, Trace as Jn, SnapshotNotEntitled as Jt, DecisionProvider as K, Obligation as Kn, SnapshotAssignable as Kt, SubjectOf as L, Decision as Ln, InstanceHandle as Lt, PrincipalOf as M, inherit as Mn, credentialDelegation as Mt, RoleBinding as N, plan as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, actor as On, isConditionRef as Or, CredentialPolicy as Ot, RoleOptions as P, relation as Pn, decideCredential as Pt, LimitStore as Q, Assurance as Qn, AutomationEvent as Qt, SupportAccessOptions as R, Denial as Rn, Instant as Rt, HostedGrantRef as S, holder as Sn, RestrictedAncestors as Sr, ApiKeyPrincipal as St, Policy as T, GranteeInput as Tn, hasConditionOp as Tr, CredentialKind as Tt, CredentialVerifier as U, GrantedDecision as Un, LocalSnapshotManifest as Ut, VocabularyFromInput as V, DeniedDecision as Vn, LocalRowColumn as Vt, CustomRoleSource as W, LimitDetail as Wn, LocalSnapshotRows as Wt, LimitConsumeInput as X, TraceSkipReason as Xn, AccessEvent as Xt, JwtClaims as Y, TraceSkip as Yn, SnapshotScope as Yt, LimitRemaining as Z, Actor as Zn, AuthEvent as Zt, GrantLimit as _, ApproverInput as _n, MemberOfCondition as _r, SupportSessionDecision as _t, ApprovalRequirement as a, EmailCategory as an, JsonWebKeyLike as ar, SettingsSource as at, GrantScope as b, allOf as bn, RelatedCondition as br, decideSupportSession as bt, BreakGlassOptions as c, WireDecision as cn, SharedCustomRole as cr, TenantSettings as ct, ClosureContext as d, PolicyScopesInput as dn, ActorKind as dr, TokenVerifier as dt, DecisionEvent as en, Binding as er, MembershipSource as et, ClosureGrantFn as f, Scope as fn, AdapterId as fr, VerificationFailure as ft, GrantCondition as g, Approver as gn, ConditionValue as gr, SupportSession as gt, Grant as h, AnyOfApprover as hn, ConditionRef as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, DirectoryEvent as in, GnapAccess as ir, RelationSource as it, PolicyVocabulary as j, authenticated as jn, DecideCredentialOptions as jt, PolicyOptions as k, anyone as kn, isSqlFunctionField as kr, CredentialPolicyViolation as kt, BreakGlassRequirements as l, WireDenial as ln, Subject as lr, TokenFailureCause as lt, DelegationTarget as m, ScopeNames as mn, Condition as mr, WhereCompiler as mt, ApprovalEscalation as n, DeliveryEvent as nn, CustomRoleGrant as nr, RelationGroup as nt, ApprovalStage as o, MembershipEvent as on, Membership as or, SnapshotSource as ot, DelegationInput as p, ScopeDeclaration as pn, MembershipVia as pr, VerifiedToken as pt, DecisionSink as q, Quota as qn, SnapshotGrant as qt, ApprovalMode as r, DeliveryFailureCause as rn, Delegation as rr, RelationHolder as rt, AssuranceRequirement as s, SinkEvent as sn, Principal as sr, SubjectResolver as st, ActivationOption as t, DeliveryChannel as tn, CustomRole as tr, RelationChain as tt, BreakGlassSpec as u, WireDelegation as un, VerifiedClaims as ur, TokenSigner as ut, GrantMeta as v, PermissionApprover as vn, MemberOfParent as vr, SupportSessionPolicy as vt, ObligationInput as w, Grantee as wn, SqlFunctionCondition as wr, CredentialDecision as wt, GrantValidity as x, anyOf as xn, RelatedHop as xr, parseSupportSession as xt, GrantOptions as y, UserApprover as yn, OpaqueCondition as yr, SupportSessionRequest as yt, SupportConsent as z, DenialDetails as zn, LocalCustomRoleTable as zt };